As artificial intelligence technologies grow ever more powerful, so do the risks they pose and with them the urgency of regulating AI.
In July 2026, OpenAI’s advanced models hacked into AI company Hugging Face’s systems during internal cybersecurity evaluations by communicating through unauthorized channels and working around safeguards developers had imposed on the models. In January 2026, Google and Character.ai, which makes a role-playing AI chatbot, agreed to settle a wrongful death lawsuit brought by Megan Garcia. Her 14-year-old son, who used the chatbot heavily, died by suicide.
As these and other cases show, AI harms can emerge across different technologies, organizations and contexts. As a legal scholar focused on AI and digital harms, I study how to regulate AI.
Policymakers and industry commentators have tended to frame regulation as a trade-off between the risks of AI and the risks of regulating AI. In its 2025 AI Action Plan, the Trump administration called for removing “red tape and onerous regulation,” which it said hinders economic growth. The administration has also sought to limit conflicting state AI laws.
In contrast to the broad concerns about the costs of AI regulation, AI harms have largely been addressed through rules specific to particular technologies. The federal Take It Down Act, signed in 2025, for example, addresses nonconsensual intimate imagery, including AI-generated deepfakes, as do various state laws. These approaches are crucial, but they don’t solve the problem by themselves.
The emerging patchwork of rules has yet to establish a regulatory architecture that connects protected interests, institutional obligations and individual rights across AI technologies. Protected interests are rights recognized by the law, such as property ownership and personal privacy. A harm-centered approach would begin with those interests and use them to shape legal obligations that span relevant systems, organizations and people.
Types of harm
A harm-centered approach starts by identifying the fundamental interests that AI systems can threaten. These overlapping interests include:
- Privacy: when AI systems improperly collect, process or disclose personal information.
- Autonomy: when AI systems target a person’s vulnerabilities and manipulate their choices or encourage unhealthy dependence.
- Equality: when AI systems discriminate or reinforce bias.
- Safety: when AI systems cause physical, psychological or security harms.
These examples are not exhaustive. Other interests may also be at stake as AI technologies evolve.
The same interest can be threatened by different technologies and different entities. A teenager’s safety can be harmed by the engagement mechanisms of a social media platform or by an AI companion designed to sustain an emotional relationship.
Designing regulations based on a concept of harm allows laws and principles to follow problems as the technology changes. And it helps determine obligations imposed on developers, deployers and other stakeholders involved in AI.
For instance, AI developers could be required to conduct harm assessments throughout the development of AI systems, identifying reasonably foreseeable harms, documenting how they tested for them and explaining what mitigation measures they took. Companies or government agencies that deploy AI systems could also have duties to monitor harms after deployment. Serious or recurring harms could trigger obligations to report them to relevant regulators, affected individuals or the public, depending on the nature and severity of the harm.
A harm-centered framework could also recognize corresponding rights for people affected by AI systems, including rights to notice and opportunities to seek redress where appropriate. These rights would arise from the same protected interests that justify obligations on companies.
The point is to build a regulatory architecture on the detection and reduction of harm across AI applications, developers and users. What matters most is whether and how AI-enabled design or operation contribute to harm.
A common basis for law
This mindset is followed in other areas of law.
Environmental law, for instance, has long regulated industries by focusing on their environmental effects rather than on technology alone. It requires regulated companies to monitor emissions and discharges, maintain records and report specified releases to regulators. Some reporting requirements also make information available to the public. Environmental review under the National Environmental Policy Act requires federal agencies to assess environmental effects and provides opportunities for public participation.
AI governance could draw on this logic, determining who is responsible for assessment, monitoring, disclosure and mitigation based on types of harm.
A harm-based focus would not eliminate technology-specific rules. Some technologies create distinctive risks that justify targeted rules, such as disclosure requirements for AI-generated deepfakes or safeguards for AI systems used in high-stakes decisions. And focusing on harm does not mean regulating every conceivable risk of harm.
But I believe that harm should become the organizing principle of AI regulation. New AI systems will bring harms policymakers have not yet anticipated. The challenge is to build a framework for the harms we know, as well as the harms we do not yet know.
Sylvia Lu does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
